Looking at SBOM practices

Open source tools, libraries within programming languages, package managers, and container images are the building blocks of the modern application and also introduce a unique set of challenges when it comes to securing your software supply chain. This is what we affectionately call the supply chain security conundrum. How do you maintain a good security posture when you don’t own all of the code that needs to be secured?

If we represent the supply chain visually, it’ll have some unknown people (we’ll call them actors) contributing to an open source dependency and another likely known actor contributing to your code base more directly. This is an extremely simplified drawing (there are probably 10 boxes missing here) but it should help you get the point:

Figure 7.6: Example supply chain

Your software supply chain is everything and everyone is involved in releasing your app. When we look at how to maintain...